Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 02:27
Static task
static1
Behavioral task
behavioral1
Sample
5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html
Resource
win10v2004-20240426-en
General
-
Target
5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html
-
Size
41KB
-
MD5
5cb8a603353700678f2ed4f1a1263be8
-
SHA1
57d0db95b93074f6e9432c8817a8b2c4ced75b4c
-
SHA256
dcd87bf140167a31fc8607b0e032dd85b91f2151c8682ffffe5a117db36f961f
-
SHA512
f68659f1857bafe86481b39dbe3312fd51ae8ccbffdfdc7961eebafbc36717378aa46a70844b76c8986e08e0d0a681fd680f2a09b0c851abbf8b6644e045f0e3
-
SSDEEP
768:SLQ29SFtPn4yqeqWkmu0NBlR2EThL5BBpL0PXzlaOYufszMoYSLaEknE3LTbBmlX:SLQ29SFppqeZkmu0NBlR2EThL5BBpLEv
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3392 msedge.exe 3392 msedge.exe 3640 msedge.exe 3640 msedge.exe 1652 identity_helper.exe 1652 identity_helper.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe 4956 msedge.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe 3640 msedge.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 1176 3640 msedge.exe 82 PID 3640 wrote to memory of 1176 3640 msedge.exe 82 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3152 3640 msedge.exe 83 PID 3640 wrote to memory of 3392 3640 msedge.exe 84 PID 3640 wrote to memory of 3392 3640 msedge.exe 84 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85 PID 3640 wrote to memory of 2424 3640 msedge.exe 85
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5cb8a603353700678f2ed4f1a1263be8_JaffaCakes118.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc8b8946f8,0x7ffc8b894708,0x7ffc8b8947182⤵PID:1176
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:22⤵PID:3152
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:3392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:82⤵PID:2424
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:12⤵PID:2492
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:1512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:12⤵PID:4644
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:12⤵PID:4680
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2608 /prefetch:82⤵PID:4820
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1260 /prefetch:12⤵PID:1928
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2728 /prefetch:12⤵PID:4512
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:12⤵PID:4716
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:12⤵PID:4696
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,14412975482030912568,4910703137904034134,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3756 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4956
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1220
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
152B
MD51ac52e2503cc26baee4322f02f5b8d9c
SHA138e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA256f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
SHA5127670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
-
Filesize
152B
MD5b2a1398f937474c51a48b347387ee36a
SHA1922a8567f09e68a04233e84e5919043034635949
SHA2562dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
SHA5124a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize648B
MD5c6fded3ed2965d13483c7eb898b3415c
SHA1569a25f72567a05e26ede383e2ed142a646c748f
SHA25607c671a3912d2e4a905c074c01979a637a0c8b5c5874dadb5f83c609301cbc10
SHA5120e6a0cd02ebe9e20242f701ef1e2d92709f4f3b7db9b006cc011b7bd83458a7a401e75a1ad6a63c933860d519a88fe253dd43c5801228a5e0855f77fae1b399c
-
Filesize
923B
MD5ae033b78b485db9f7708d1d846f981b8
SHA1d90816eb91a24853cfb199d486d1c96fb9198b6c
SHA2568083d48a8c4d9aa5a96fece323ec2e3374c939c326a2f780c27d901b0dffe2b9
SHA512e67397de2634306ba9f60828bc395c1ecc04adecf77bca348c2a0f2a477eeab2481bb7923044e155c122d6af118392de3280be8ca627a9fad2bcade29ef84bce
-
Filesize
5KB
MD50050955dd69f5a273bc60637cbddaebe
SHA1b8866efa176ad40ac365fbb982f73f6fd41e73fe
SHA256b27bc82c2580e9b50a2acce5017bd96afa078662ee6419d720c38578a8aeb119
SHA5120608533f3954e7178db80d0dc5102e347acf2579eadfec33f9bbec8ce07401c77c1ad0b8f0b5a808fdf109f9b742a0f4a867e2283497b6a40a48490ab498ed32
-
Filesize
7KB
MD562d26246e14a002a5bff559498bfc35f
SHA154360a7aabd36f1643b8e0d3348ea607d669bdd0
SHA2562cf198629c136a7df276be83c19e7ceaa94cc05b2b7fff6f6381ef9de5a74cdf
SHA5120612ea84892a50d9c9e93737bfd5b2558ef7b8bed3131dbdbce0d46bef9c1cfb2641e238ddd7f4e1399314b175b3ab6f30cb02e8ebf6dbcfc8d04cdbf59aa353
-
Filesize
6KB
MD527b7a6138cc1b48331523531c9b2e019
SHA1c97816e67aee3f5a814ae2c07d3a258fc1dcd1ab
SHA2561eb895cac1d32246fc41c75f11ea011a99acf13a550faca24261ed475ea5e3f1
SHA512ed67ac89e7d1faa0473bd142db6918d6a400667d4d9cee485a1530e6707318571a4547d9f9a107631dc36b8fdf76bd0206079bce36c151a374f7c791176ba7e5
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5ee990523db12673f4af13dc0c848c7c6
SHA12e202c427337382ffb4965a908b5139c5726f4ff
SHA2562fbaee66e79525ec2c9f00a36f8a569311c6a4870b061a0e0296f6b7ca0eb29a
SHA51250d1ceab5ac66a81528b1ee2468c599880f13640b5a42c8bbba636bd532724ef1f095640c659f03930541c08eb1db3b2a632cf21861e0182a87f1a08bb545850